UAT-10147 Uses AI-Assisted SPECTRE and Noodle RAT in Server Intrusions

Cisco Talos reported that Chinese-speaking threat actor UAT-10147 targeted vulnerable internet-facing Windows IIS and Linux servers worldwide, using publicly disclosed one-day flaws to gain access and then deploying a broad post-compromise toolkit tied to SEO fraud and data theft. Talos said the group used AI-assisted workflows to automate reconnaissance, exploit validation, payload deployment, persistence, and operational documentation, and maintained infrastructure suggesting significant scale, including a target list of roughly 170,000 URLs. On compromised Windows systems, the actor used batch scripts, scheduled tasks, rogue user creation, EfsPotato, and Defender exclusions; on Linux, it relied on web shells and local privilege-escalation exploits to obtain root access.

A central payload in the campaign was SPECTRE, a custom cross-platform backdoor for Windows and Linux that supports HTTP-based command and control, anti-analysis, process injection, credential access, and on Windows a BYOVD technique to reduce EDR visibility by unlinking kernel callbacks. On Linux, SPECTRE deployed a rootkit called Specter, disguised as acpi_pad.ko and persisted through a fraudulent systemd service to hide processes and modules and elevate privileges. Talos also observed Noodle RAT, QuasarRAT, Gh0stCringe, Meterpreter, and web shells in the same operations; prior research has linked Noodle RAT variants to multiple Chinese-speaking espionage and financially motivated clusters, including Linux samples that copy themselves to /tmp/CCCCCCCC, decrypt configuration with RC4 using the hardcoded key r0st@#$, and connect to attacker-controlled C2 servers.